If your HVAC or plumbing shop runs high-volume Google LSA or Meta ad bursts, you already know the sound of a dispatch pipeline choking.
One minute leads are rolling in smoothly, and the next, your CRM integration throws a wall of HTTP 429 rate limit errors or silent webhook drop-offs. Morning concurrency spikes hit, ServiceTitan v2 throttles your requests, and booked jobs vanish into the ether before they ever touch your dispatch board.
To make matters worse, almost every existing guide online assumes you are running a monolithic app server that can afford database locks and lazy JSON parsing. If you are building modern trade tech or managing multi-tenant lead pipelines, that approach breaks down instantly.
Here is how we solved it at Kalloway & Thayer Systems by building a zero-dependency V8 edge ingestion middleware.
The Root Cause: Why Standard Webhook Bridges Fail
When third-party lead forms or aggregators fire bursts of webhooks into your integration layer, three major failure modes trigger immediately:
Token Exhaustion & Rate Limiting: ServiceTitan's OAuth token endpoint and API v2 rate limits will aggressively block you if multiple threads request tokens simultaneously or exceed per-second thresholds (typically 60 req/s). Standard middleware slams the auth endpoint on every single request instead of caching with a single-flight promise. Stateless Serverless Cold Starts: If you deploy standard webhook handlers on AWS Lambda or Vercel without edge protection, cold starts wipe your in-memory OAuth tokens and rate buckets right when your morning ad spend kicks off. Unstructured Payloads & Schema Drift: Phone extensions get lumped into raw strings, East Coast zip codes drop leading zeros, and casing drift creates duplicate customer records in your CRM. The Solution: Zero-Dependency V8 Edge Architecture
Instead of fighting bloated ORMs or slow database writes, we built a zero-dependency ingestion engine that runs natively on Node.js v18+ / v24+ with an ultra-lean memory footprint (~5.1 MB heap).
It handles single-flight 15-minute OAuth caching, leaky-bucket rate pacing, and timing-safe HMAC webhook verification out of the box.
- Single-Flight OAuth Caching & Leaky-Bucket Pacing
To prevent HTTP 429 lockouts during peak morning dispatch hours, the client uses an in-flight auth map and precise millisecond interval calculation per tenant:
JavaScript
export class ServiceTitanClient {
constructor({ appKey, environment = "production", maxRequestsPerSecond = 55, maxRetries = 2 } = {}) {
if (!appKey) throw new Error("ServiceTitanClient requires 'appKey' header.");
this.appKey = appKey;
this.intervalMs = Math.ceil(1000 / Math.min(maxRequestsPerSecond, 60));
this.maxRetries = maxRetries;
this.tokenCache = new Map();
this.inFlightAuth = new Map();
this.tenantNextSlot = new Map();
}
async _acquireSlot(tenantId) {
const tKey = String(tenantId);
const now = Date.now();
const nextAt = this.tenantNextSlot.get(tKey) || 0;
const waitMs = Math.max(0, nextAt - now);
this.tenantNextSlot.set(tKey, Math.max(now, nextAt) + this.intervalMs);
if (waitMs > 0) await new Promise((r) => setTimeout(r, waitMs));
}
}
- Timing-Safe Webhook Verification
Before allocating any memory to parse incoming payloads from external lead forms, incoming signatures are verified using constant-time crypto comparisons to prevent timing attacks:
JavaScript
export function verifyWebhookSignature(rawBody, signatureBase64, signingKey) {
if (!rawBody || !signatureBase64 || !signingKey) return false;
const computed = crypto
.createHmac("sha256", signingKey)
.update(typeof rawBody === "string" ? Buffer.from(rawBody, "utf8") : rawBody)
.digest();
const provided = Buffer.from(signatureBase64, "base64");
if (computed.length !== provided.length) return false;
return crypto.timingSafeEqual(computed, provided);
}
Drop It Into Your Stack Today
If you want to bypass the boilerplate and stop dropping leads during your next ad burst, you can install our client library directly into your project:
Bash
npm i @kallowaythayer/servicetitan-v2
You can check out the source repository and documentation over at GitHub or visit kallowaythayer.com for a live ingress pipeline audit.
